[CRIU] Towards an in-process libcriu

[Pavel Emelyanov]

On 07/17/2014 06:40 PM, Serge Hallyn wrote:
> Quoting Pavel Emelyanov (xemul at parallels.com):
>> On 07/17/2014 12:41 AM, Saied Kazemi wrote:
>>> Having libcriu with C bindings is a great feature.  In addition to LXC as Tycho has mentioned,
>>> other Docker exec drivers will be able to use it too.  In fact, from within any program, one 
>>> would call dump() and restore() to do what is currently done on the command line.
>>
>> But you can call dump and restore from libcriu right now. The only requirement is
>> to have criu service launched. What problems do you have with that?
>>
>> As I mentioned the biggest concern is -- the in-code libcriu would be root-only.
>> Would this work with Docker, as AFAIR it starts from non-root user?
> 
> This *would* be a disappointment for lxc since we can now create and start
> containers without being root;  but I rather assumed it was the case for
> criu anyway.  If you are saying that, if we write a simple c library, we
> can dump non-root tasks without being root (as we used to with the old
> cryo ptrace-based one :)  that would rock and could justify the effort.

We can do that, but this would require patching the kernel. For example,
criu heavily uses the /proc/pid/map_files/ directory which is CAP_SYS_ADMIN
only. And there are quite a few more places in the kernel with the same.

Thanks,
Pavel